Verified

Fastly MCP Server

Fastly API management through search, inspection, and JavaScript execution tools.

Data last scanned today · Reviewed today

0 1 dangerous tool3 tools★ 39JavaScriptMIT

Overview

This server bridges the Fastly API with MCP-compliant AI assistants, facilitating service lookups, domain inspections, and configuration management. It uses a three-stage interaction workflow: searching for specific API methods, inspecting their documentation, and executing targeted JavaScript snippets to perform operations. By leveraging the bundled Fastly client documentation, the server keeps its tool surface area compact. This approach requires users to authenticate via a Fastly API token, which can be scoped to read-only or write access depending on the intended task and security requirements.

Our verdict

With a security score of 30/100, this server is currently classified as high risk. The evaluation process has not yet verified the authentication mechanisms or the safety of the read-only mode, and the repository is maintained by a single contributor. Users should exercise caution and use the narrowest possible Fastly API token scope to minimize potential exposure, particularly when granting the server write access to production configurations.

Uses a compact, keyword-driven tool interaction model
Maintains Tier 1 Fastly open-source support status
Includes five direct dependencies to limit supply-chain surface
Provides documented guidance on API token scoping

High-risk security score of 30/100
Authentication methods remain unreviewed
Project managed by a single contributor
Read-only mode implementation not yet verified

Setup

Claude Desktop

{
  "mcpServers": {
    "fastly-mcp": {
      "args": [
        "-y",
        "@fastly/mcp"
      ],
      "command": "npx"
    }
  }
}

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.

No read-only mode — running this grants full read/write access.
No built-in authentication — anyone with access to this config can invoke every tool it exposes.

Tools

Tool	Description	Risk
search	Finds relevant API methods by keyword, method name, API class, or HTTP path.	low
inspect	Returns the documentation for one method, including parameters, return type, and example usage.	low
execute	Runs a short JavaScript snippet with the Fastly client already available and authenticated.	high

Compatibility

Client	Local	Docker	Remote	Read-only
Claude Desktop
Cursor
VS Code
Windsurf
ChatGPT

Frequently asked questions

›What runtime environment do I need to run this server?

You need either Bun or Node.js 22 or newer installed on your system.

›How should I configure my Fastly API token?

You can provide the token by setting the FASTLY_API_TOKEN environment variable in your MCP client configuration or your shell environment. It is recommended to use the narrowest token permissions necessary for your specific tasks.

›Why does the command include the -p flag?

Using the explicit -p @fastly/mcp flag ensures that bunx or npx executes the correct binary, preventing conflicts if other packages on your system also happen to provide a binary named mcp.

›How does the server interact with the Fastly API?

The server uses a three-step workflow where an assistant searches for relevant API methods, inspects their documentation and parameters, and then uses an execute tool to run a JavaScript snippet with a pre-authenticated Fastly client.

›Can I use this server with multiple clients simultaneously?

Yes, you can start the server with the --transport http flag to enable Streamable HTTP transport, which allows multiple local clients to connect to a single long-lived server instance.